Post by @briankrebs@infosec.exchange

New, by me: Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies

Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.

https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies/

#botnet #cybercrime #google #IoT #xcpe

A map of the world depicting Google's impression of the XCPE botnet infections by country. Much of the world is some shade of blue, meaning varying degrees of install base. One big area of the map with no visible infections is, you guessed it, China.

Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies – Krebs on Security

#xcpe #botnet #iot #cybercrime #google

2 Boosts

0 Likes

Fubaroque

@fubaroque@mastodon.social 17 min. ago

@briankrebs We are blocking AI bots that do not respect our robots.txt, basically to prevent our website from going down under the load. More than half a million ip-addresses blocked already.

I think AI bots are also big users of these residential proxy networks.

@iveyline

@Iveyline@mastodon.nz 2 hr. ago

@briankrebs The IOT is turning out to be a hackers paradise. This example plus hackers setting freezers and chillers at 50 C in Europe so all the stock is ruined are just two examples. A crntralised Internet is like a centralised electricity generation and distribution network. Vulnerable and high risk.

Ben

@ben@snac.benbuhse.com 3 hr. ago

@briankrebs@infosec.exchange is there some reasonable outbound firewall set up to try block things like this?

BrianKrebs

@briankrebs@infosec.exchange 3 hr. ago

@ben are you asking if there's a safe way to use the tv boxes mentioned in the reports? I doubt you could block the bad stuff while still being able to stream content, but even when these devices are not being used to stream video content, they are typically then used for ad fraud. I wrote about one tv-box botnet a few months ago that had this configuration, where the TV boxes spoofed themselves as mobile phones clicking ads on AI-generated slop websites.

https://krebsonsecurity.com/2026/07/read-this-before-you-buy-that-tv-streaming-stick/

Read This Before You Buy That TV Streaming Stick – Krebs on Security

GeneralX ⏳

@generalx@freeradical.zone 4 hr. ago

@briankrebs
FYI post-pub update on Synthient's blog:

"... A representative for Linus Tech Tips reached out to clarify that their original coverage aimed to advise viewers against purchasing the device under standard circumstances. Furthermore, Linus Media Group stated they have since updated the video to explicitly frame the product as a scam and have removed all associated affiliate links."

https://synthient.com/blog/the-internals-of-a-badbox-operation

Synthient

The Internals of a Badbox Operation | Synthient

Synthient’s investigation traces more than 1.3 million backdoored Android devices to Videostrong, revealing how the x.cpe backdoor distributes residential...

ℂ𝕖𝕝𝕖𝕤𝕥𝕖

@rogue_cells@chaos.social 4 hr. ago

@briankrebs Sounds familiar. Wasn't there a botnet doing similar things a couple of years back using something called "badboxes" or something of that sort, aka. malware infected movie piracy devices and TV sticks?

BrianKrebs

@briankrebs@infosec.exchange 4 hr. ago

@rogue_cells I also wrote about the Superbox thing last fall, and it was subsequently covered by Darknet Diaries.

https://krebsonsecurity.com/2025/11/is-your-android-tv-streaming-box-part-of-a-botnet/

Is Your Android TV Streaming Box Part of a Botnet? – Krebs on Security

BrianKrebs

@briankrebs@infosec.exchange 4 hr. ago

@rogue_cells Yes, correct. This botnet is largely considered to be an extension of the Badbox 2.0 botnet.

ṫẎℭỚ◎ᾔ ṫ◎ℳ

@TycoonTom@infosec.exchange 4 hr. ago

@briankrebs half my family owns these Android TV set-top boxes 📺🤦‍♂️ from Amazon🤷‍♂️